DNS

Why there is no nameserver

cPanel, Plesk and DirectAdmin all ship BIND or PowerDNS and become responsible for other people's domains. That means glue records, at least two geographically separate secondaries, DNSSEC key rollovers and an on-call rota, on a box whose whole premise is that one machine runs everything. When that nameserver is down, every domain it names is down, including sites hosted somewhere else entirely.

So you keep your registrar and your DNS provider. KLYRN connects to it, says plainly when a name does not point here, and gives you one button that fixes it.

Connecting a provider

Cloudflare is the provider built in today. The credential is verified before it is stored (a credential that is saved and tested later is a credential that fails at the moment somebody needed it) and it is sealed at rest.

klyrn dns connect --kind cloudflare --label "Acme Cloudflare" --token <token>
klyrn dns providers
klyrn dns disconnect 2

The token can be supplied in the KLYRN_DNS_TOKEN environment variable instead of on the command line. It must be an API token with Zone · DNS · Edit; a Global API Key is refused, because a global key can do anything to every zone on the account and KLYRN has no business holding one.

--account ties a connection to one hosting account instead of the whole server, which is how a reseller gives each customer their own credential. A single account may hold up to four connections.

Editing records

klyrn dns records example.com
klyrn dns set example.com A @ 203.0.113.10 --ttl 300
klyrn dns set example.com TXT _dmarc "v=DMARC1; p=none; rua=mailto:you@example.com"
klyrn dns set example.com MX @ mail.provider.net --priority 10
klyrn dns delete example.com <record-id>

Writable types are A, AAAA, CNAME, TXT, MX, SRV and CAA. NS and SOA are absent on purpose: rewriting those from a hosting panel is how a domain disappears.

The TTL is 0 or 1 for the provider's automatic value, or between 60 and 86400 seconds. Record content is capped at 2048 characters.

The name guard applies to everyone, including administrators. A record can only be written when its name is a domain KLYRN hosts for that actor, or a name inside one. Anything else is refused with "KLYRN only edits DNS for the sites it hosts". A panel that holds a customer's DNS credential must not be able to edit the rest of their zone.

Point this site here

klyrn dns check example.com    # what each name resolves to, and whether that is here
klyrn dns point example.com    # create or update the A records for every name the site serves

point writes A records at TTL 300, unproxied, for every name the site answers for. It skips a name that is not in the zone, and it skips a name that is currently a CNAME, reporting the target, and saying to remove it first if this site should serve the name. Silently deleting somebody's CNAME is not KLYRN's decision to make.

check never estimates propagation time, because nobody can know it. It tells you what the record says now.

Mail records

KLYRN hosts no mail, so your MX, SPF, DKIM and DMARC records point at whichever mail provider you use. They are ordinary records and you can write them with klyrn dns set like any other. Nothing on the server needs to know about them, and nothing KLYRN does will overwrite them: point only touches A records for names the site serves.